• Myria
  • New member
  • Offline
  • Registered: 2018-05-01
  • Posts: 2

Has there been consideration to hack CD burner firmware to dump Dreamcast disks?  I don’t think it’s all that difficult, assuming that the laser unit is capable of reading the high density area at all and the firmware is hackable.

These are the patches that’d be needed:

* If a disk’s first TOC has no B0 entry, the TOC has a sufficiently small A2 entry, and the TOC’s own timestamps in sub-Q use positive encoding (00:00:00 start rather than 99:59:74 end) fake that there is a B0 entry around 08:00:00 or so.

* If that condition is met, modify all MSF<->LBA conversions to consider 9x:xx:xx to be positive 90 minutes instead for standing for negative. Likewise, don’t reject invalid BCD ten-minute encodings like C2:00:00.

* When seeking, adjust the calculation of where to move the laser head if past 08:00:00 according to the higher density.

* Allow CD audio read command on data tracks.  This is useful anyway, and some drives already allow this.

* Don’t reject out-of-bounds read requests.  This allows dumping the “PRODUCED BY SEGA ENTERPRISES” area—yes, that area is actually readable in CD audio mode.  (It uses SafeDisc 2-like weak sectors.)

With these changes, it’s likely that you could stick a GD-ROM into the hacked drive and Windows will browse to the high density file area automatically.

  • user7
  • Moderator
  • Offline
  • Registered: 2009-03-14
  • Posts: 2,621

It sounds like you might be the foremost expert on this subject, so ... if it's ever going to happen will probably be you doing it.

If you go for it, good luck! Easier Dreamcast dumping would be awesome!

All my posts and submission data are released into Public Domain / CC0.
  • Registered: 2015-02-24
  • Posts: 101

Myria wrote:

Has there been consideration to hack CD burner firmware to dump Dreamcast disks?  I don’t think it’s all that difficult, assuming that the laser unit is capable of reading the high density area at all and the firmware is hackable.

There was some brief discussion on this subject a while back (at http://forum.redump.org/topic/29341/tho … led-reads/). Well, not exactly this subject, but the general idea of modifying a firmware to enable scrambled reads. I think if someone made it far enough to hack the TOC to enable scrambled reads and similar, the rest of this could probably be done as well.

I very briefly did some work on reverse engineering the firmware from an old Samsung DVD-/+RW drive. But, I'm absolutely awful at reverse engineering, and I've never done assembly in 8501 or ARM or many of the ISAs that are prominent in optical drive controllers, so it was very much an uphill battle.

But, I still think it's likely a reasonable approach to enabling better drive support for a lot of dumping tasks. It will require someone with a nice mix of knowledge on RE and optical disc technology, and a lot of free time, and I don't think there are a lot of folks around that meet all of those criteria, though.

  • Registered: 2019-05-25
  • Posts: 1,221

Myria wrote:

* If a disk’s first TOC has no B0 entry, the TOC has a sufficiently small A2 entry, and the TOC’s own timestamps in sub-Q use positive encoding (00:00:00 start rather than 99:59:74 end) fake that there is a B0 entry around 08:00:00 or so.

There are usually no TOC B0 entries on 99% of the CD's. I saw them only on some multisession pressed CD's. From what I know it's used for CD-R.


Myria wrote:

This allows dumping the “PRODUCED BY SEGA ENTERPRISES” area—yes, that area is actually readable in CD audio mode.  (It uses SafeDisc 2-like weak sectors.)

Can you elaborate? I never heard of "weak sectors" before.